Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
43s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 16:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
kayflock-beta.exe
Resource
win7-20240221-en
4 signatures
60 seconds
Behavioral task
behavioral2
Sample
kayflock-beta.exe
Resource
win10v2004-20240319-en
4 signatures
60 seconds
General
-
Target
kayflock-beta.exe
-
Size
1.5MB
-
MD5
60870aeea40cf956a4144040262f9ad4
-
SHA1
0010576075dff708aee85f069f371e848f729b58
-
SHA256
ec1e04459cd3d6bca52b4b3e0e810352c3ae32781c1b097be2145de9964e1ac6
-
SHA512
1a135a3c3d255830fba48a2b4f598521a19e1817b967b9855a28597ac62460bc04335f10e62a9a627d59ef25617c64949d07f070029451f28654d956c70b548a
-
SSDEEP
24576:KYv3rBPikLE3SHTb2DS74nMfxru7T/AnitacsI0n3/oUEWzS05UEdIKz3z:f396kA3SzaDznAxrgwnc43/oUVzS0
Score
8/10
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\frAQBc8Wsa1xVPfv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\frAQBc8Wsa1xVPfv" kayflock-beta.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4128 kayflock-beta.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeLoadDriverPrivilege 4128 kayflock-beta.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4128 wrote to memory of 3264 4128 kayflock-beta.exe 95 PID 4128 wrote to memory of 3264 4128 kayflock-beta.exe 95 PID 3264 wrote to memory of 4312 3264 cmd.exe 97 PID 3264 wrote to memory of 4312 3264 cmd.exe 97 PID 3264 wrote to memory of 4664 3264 cmd.exe 98 PID 3264 wrote to memory of 4664 3264 cmd.exe 98 PID 3264 wrote to memory of 4292 3264 cmd.exe 99 PID 3264 wrote to memory of 4292 3264 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\kayflock-beta.exe"C:\Users\Admin\AppData\Local\Temp\kayflock-beta.exe"1⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\kayflock-beta.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\kayflock-beta.exe" MD53⤵PID:4312
-
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵PID:4664
-
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵PID:4292
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2288,i,10301911031503898037,2997280636231771547,262144 --variations-seed-version /prefetch:81⤵PID:1036